To: 


Of: 


ICO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTICE 


Colour Car Sales Limited 


Unit 1 & 2 Mossfield Road, Stoke-on-Trent, England ST3 5BW 


The Information Commissioner (“the Commissioner”) has decided to 
issue Colour Car Sales Limited (“CCSL”) with an enforcement notice 
under section 40 of the Data Protection Act 1998 (“DPA”). The notice is 
in relation to a serious contravention of Regulation 22 of the Privacy 
and Electronic Communications (EC Directive) Regulations 2003 
(“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


CCSL, whose registered office is given above (Companies House 
Registration Number: 10382413) is the organisation stated in this 
notice to have instigated the transmission of unsolicited 
communications by means of electronic mail to individual subscribers 


for the purposes of direct marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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Section 122(5) of the DPA18 defines direct marketing as “the 
communication (by whatever means) of any advertising material which 
is directed to particular individuals”. This definition also applies for the 


purposes of PECR (see regulation 2(2) PECR & Schedule 19 paragraphs 
430 & 432(6) DPA18). 


Prior to 29 March 2019, the European Directive 95/46/EC defined 
‘consent’ as “any freely given specific and informed indication of his 
wishes by which the data subject signifies his agreement to personal 


data relating to him being processed”. 


Consent in PECR is now defined, from 29 March 2019, by reference to 
the concept of consent in Regulation 2016/679 (“the GDPR”): 
regulation 8(2) of the Data Protection, Privacy and Electronic 
Communications (Amendments etc) (EU Exit) Regulations 2019. Article 
4(11) of the GDPR sets out the following definition: “'consent’ of the 
data subject means any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


Recital 32 of the GDPR materially states that “When the processing has 
multiple purposes, consent should be given for all of them”. Recital 42 
materially provides that “For consent to be informed, the data subject 
should be aware at least of the identity of the controller”. Recital 43 
materially states that “Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 
processing operations despite it being appropriate in the individual 


case”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 
and includes an unincorporated body of such individuals”. 
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A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 


a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail’ is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


The term "soft opt-in" is used to describe the rule set out in in 
Regulation 22(3) of PECR. In essence, an organisation may be able to 
e-mail its existing customers even if they haven't specifically consented 
to electronic mail. The soft opt-in rule can only be relied upon by the 
organisation that collected the contact details. 


The DPA contains enforcement provisions at Part V which are 
exercisable by the Commissioner. Those provisions are modified and 
extended for the purposes of PECR by Schedule 1 PECR. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that if the Commissioner is satisfied that a person has 
contravened or is contravening any of the requirements of the 
Regulations, she may serve him with an Enforcement Notice requiring 
him to take within such time as may be specified in the Notice, or to 
refrain from taking after such time as may be so specified, such steps 


as are so specified. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 


subsequently amended and strengthened. The Commissioner will 
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interpret PECR in a way which is consistent with the Regulations’ 


overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


The contravention 
The Commissioner finds that CCSL contravened regulation 22 of PECR. 
The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 1 October 2018 and 21 January 
2020 there were 274 direct marketing text messages received by 
subscribers which are capable of being evidenced by complaints. The 
Commissioner finds that CCSL instigated the transmission of the direct 


marketing messages sent, contrary to regulation 22 of PECR. 


The Commissioner is not assisted by CCSL’s failure to engage with her 
during this investigation to explain the relationship between CCSL and 
Ree However she is satisfied that for the purposes 
of the direct marketing messages sent from iii 


Text Local account, CCSL positively encouraged the sending of those 
messages. She makes this finding in light of the information provided 
by Text Local in response to the Commissioner’s 3PIN, and in view of 
the content of the unsolicited direct marketing messages sent which 


resulted in 274 complaints. 


CCSL, as the instigator of the direct marketing, is required to ensure 


that it is acting in compliance with the requirements of regulation 22 of 
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PECR, and to ensure that valid consent to send those messages had 


been acquired. 


In this instance, individuals applying for finance via one of CCSL’s sites 
were given no option but to agree to receive direct marketing from 
CCSL and its unnamed third parties. Indeed, the statement that would 
accompany the applications did not indicate in any manner that the 
individual’s personal details would be used for direct marketing 
purposes. Furthermore, individuals could not specify the type of direct 
marketing that they might be willing to receive, rather they were 
required to agree to a suite of contact methods, from an unknown 


number of third parties. 


For consent to be valid it is required to be “freely given”, by which it 
follows that if consent to marketing is a condition of subscribing to a 
service, the organisation will have to demonstrate how the consent can 
be said to have been given freely. In this instance, CCSL has failed to 


explain how its consent could be said to be freely given. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 
organisation, that will be sending it. Again, this requirement does not 


appear to be met in CCSL’s case. 


Consent will not be “informed” if individuals do not understand what 
they are consenting to. Organisations should therefore always ensure 
that the language used is clear, easy to understand, and not hidden 
away in a privacy policy or small print. Consent will not be valid if 
individuals are asked to agree to receive marketing from “similar 
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The Commissioner is satisfied that CCSL cannot avail itself to the “soft 

opt-in” exemption provided by regulation 22(3) PECR. This exemption 

means that organisations can send marketing messages by text and e- 

mail to individuals whose details had been obtained in the course or 

negotiation of a sale and in respect of similar products and services. 

The organisation must also give the person a simple opportunity to 

refuse or opt out of the marketing, both when first collecting the details 

and in every message after that. Itis apparent from the sign-up page 

on CCSL’s websites that individuals were not provided a simple 

opportunity to refuse or opt out of the marketing, nor were they 

offered an opt-out in the subsequent direct marketing messages that 

they received. The Commissioner therefore finds that CCSL is unable to 


rely on this exemption. 


The Commissioner is satisfied that this contravention could have been 
far greater, since there is evidence that a total of 3,650,194 direct 
marketing messages were sent to individuals at the instigation of CCSL 
over the contravention period. However, because of CCSL’s lack of 
engagement, and the Communications Service Provider’s failure to 
retain such records, it has not been possible to determine the exact 
number of those messages which were received by subscribers. The 


full extent of the contravention is therefore unknown. 


The Commissioner is satisfied from the evidence she has seen that 
CCSL did not have the necessary valid consent for the 274 direct 


marketing messages received by subscribers. 


The Commissioner has considered, as she is required to do under 
section 40(2) of the DPA (as extended and modified by PECR) when 
deciding whether to serve an Enforcement Notice, whether any 
contravention has caused or is likely to cause any person damage or 


distress. The Commissioner has decided that it is likely that damage or 
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distress has been caused in this instance, not least because of the 


sheer number of complaints. 


30. In view of the matters referred to above the Commissioner 
hereby gives notice that, in exercise of her powers under 
section 40 of the DPA, she requires CCSL to take the steps 


specified in Annex 1 of this Notice. 


Right of Appeal 


31. There is a right of appeal against this Notice to the First-tier Tribunal 
(Information Rights), part of the General Regulatory Chamber. 


Information about appeals is set out in the attached Annex 2. 


Dated the 24t" day of May 2021 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


TERMS OF THE ENFORCEMENT NOTICE 


CCSL shall within 30 days of the date of this notice: 


Except in the circumstances referred to in paragraph (3) of 
regulation 22 of PECR, neither transmit, nor instigate the 
transmission of, unsolicited communications for the purposes of 
direct marketing by means of electronic mail unless the recipient of 
the electronic mail has previously notified CCSL that he clearly and 
specifically consents for the time being to such communications 


being sent by, or at the instigation of, CCSL. 
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ANNEX 2 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 48 of the Data Protection Act 1998 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (the “Tribunal”) against the 


notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 
discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3: You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 


Telephone: 0300 123 4504 
Email: grc@justice.gov.uk 
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e The notice of appeal should be served on the Tribunal within 28 


days of the date on which the enforcement notice was sent 


The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 


